cbcvebase.
CVE-2009-0919
published 2009-03-16

CVE-2009-0919: XAMPP installs multiple packages with insecure default passwords, which makes it easier for remote attackers to obtain access via (1) the "lampp" default…

PriorityP342high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
6.81%
93.2th percentile
XAMPP installs multiple packages with insecure default passwords, which makes it easier for remote attackers to obtain access via (1) the "lampp" default password for the "nobody" account within the included ProFTPD installation, (2) a blank default password for the "root" account within the included MySQL installation, (3) a blank default password for the "pma" account within the phpMyAdmin installation, and possibly other unspecified passwords. NOTE: this was originally reported as a problem in DFLabs PTK, but this issue affects any product that is installed within the XAMPP environment, and should not be viewed as a vulnerability within that product. NOTE: DFLabs states that PTK is intended for use in a laboratory with "no contact from / to internet."

Affected

68 ranges· showing 25
VendorProductVersion rangeFixed in
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
apachefriendsxampp——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.